Role Mining - Revealing Business Roles for Security Administration Using Data Mining Technology
Role Mining - Revealing Business Roles for Security Administration using Data Mining Technology
Martin Kuhlmann
Dalia Shohat
SYSTOR Security Solutions GmbH
Hermann-Heinrich-Gossen-Strasse 3
D 50858 Cologne
[martin.kuhlmann|dalia.shohat]
@systorsecurity.com
Gerhard Schimpf
SMF TEAM IT-Security Consulting
Am Waldweg 23
D 75173 Pforzheim
Gerhard.Schimpf@smfteam.de
ABSTRACT
In this paper we describe the work devising a new technique for role-finding to implement Role-Based Security Administration.
Our results stem from industrial projects, where large-scale customers wanted to migrate to Role-Based Access Control
(RBAC) based on already existing access rights patterns in their production IT-systems.
The core of this paper creates a link between the use of well established data mining technology and RBAC. We present a process for detecting patterns in a data base of access rights and for deriving enterprise roles from these patterns. Moreover, a tool
(the SAM Role Miner) is described. The result allows an organized migration process to RBAC with the goal of building a single point of administration and control, using a cross-platform administration tool.
Categories and Subject Descriptors
D.4.6 [Operating Systems]: Security and Protection – Access
Controls; H.2.0 [Information Systems]: General – Security,
Integrity, and Protection; K.6.5 [Management of Computing and Information Systems]: Security and Protection.
General Terms
Management, Security.
Keywords
Role-Based Access Control, Enterprise Systems Management,
Provisioning, Identity Management, Data Mining, Migration,
Role Engineering, Security Administration, Security Data
Models, Security Management, Single Point of Administration and Control.
1. Introduction
For several years now, many large-scale enterprises have been realizing savings through a reduction of the overall workload and through quality improvements in their enterprise wide identitybased
security
Martin Kuhlmann
Dalia Shohat
SYSTOR Security Solutions GmbH
Hermann-Heinrich-Gossen-Strasse 3
D 50858 Cologne
[martin.kuhlmann|dalia.shohat]
@systorsecurity.com
Gerhard Schimpf
SMF TEAM IT-Security Consulting
Am Waldweg 23
D 75173 Pforzheim
Gerhard.Schimpf@smfteam.de
ABSTRACT
In this paper we describe the work devising a new technique for role-finding to implement Role-Based Security Administration.
Our results stem from industrial projects, where large-scale customers wanted to migrate to Role-Based Access Control
(RBAC) based on already existing access rights patterns in their production IT-systems.
The core of this paper creates a link between the use of well established data mining technology and RBAC. We present a process for detecting patterns in a data base of access rights and for deriving enterprise roles from these patterns. Moreover, a tool
(the SAM Role Miner) is described. The result allows an organized migration process to RBAC with the goal of building a single point of administration and control, using a cross-platform administration tool.
Categories and Subject Descriptors
D.4.6 [Operating Systems]: Security and Protection – Access
Controls; H.2.0 [Information Systems]: General – Security,
Integrity, and Protection; K.6.5 [Management of Computing and Information Systems]: Security and Protection.
General Terms
Management, Security.
Keywords
Role-Based Access Control, Enterprise Systems Management,
Provisioning, Identity Management, Data Mining, Migration,
Role Engineering, Security Administration, Security Data
Models, Security Management, Single Point of Administration and Control.
1. Introduction
For several years now, many large-scale enterprises have been realizing savings through a reduction of the overall workload and through quality improvements in their enterprise wide identitybased
security
References: Review, vol. 15(1), 1997. KG, Köln, Germany (1999). E. Krieger Publishing Company, 1979. Computer Security Conference, Baltimore, MD, USA, 1992. at 2nd ACM Workshop on Role-Based Access Control, Fairfax, Virginia, USA, 1997. IEEE Computer, vol. 29(2), 1996. Germany, 2000. Workshop on Role-Based Access Control, Berlin, Germany, 2000. presented at 5th ACM Workshop on Role-Based Access Control, Berlin, Germany, 2000. Gaithersburg, MD, USA, 1995. Workshop on Role-Based Access Control, Fairfax, VA, USA, 1997. Role-Based Access Control, Fairfax, VA, USA, 1999. Information and System Security, Vol. 2 (No. 1, Febr), 1999. Informationssysteme GmbH, December 10, 1998. Kommunikations- und EDV Sicherheit 5/00, 2000.